CVE-2026-16232
Check Point SmartConsole Improper Authentication Vulnerability - [Actively Exploited]
Description
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.
INFO
Published Date :
July 22, 2026, 2:17 p.m.
Last Modified :
Aug. 10, 2026, 7:59 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CISA KEV (Known Exploited Vulnerabilities)
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.
Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Unknown
https://support.checkpoint.com/results/sk/sk185169/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-16232
Affected Products
The following products are affected by CVE-2026-16232
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | CRITICAL | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | ||||
| CVSS 3.1 | CRITICAL | [email protected] | ||||
| CVSS 4.0 | CRITICAL | [email protected] |
Solution
- Apply Check Point security updates immediately.
- Restrict access to the Management Server.
- Review Trusted Clients configuration.
- Monitor for suspicious activity.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-16232.
| URL | Resource |
|---|---|
| https://support.checkpoint.com/results/sk/sk185169 | Mitigation Patch Vendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232 | US Government Resource |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-16232 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-16232
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-16232 vulnerability anywhere in the article.
-
The Hacker News
Public PoC Released for Exploited Check Point SmartConsole Authentication Bypass
Cybersecurity researchers have shared additional technical details about a recently patched critical security flaw impacting Check Point Security Management Server and Multi-Domain Security Management ... Read more
-
TheCyberThrone
CISA adds six vulnerabilities to KEV – July 2026
On 21 and 22 July 2026, the Cybersecurity and Infrastructure Security Agency (CISA) expanded its Known Exploited Vulnerabilities (KEV) Catalog by adding six vulnerabilities spanning enterprise collabo ... Read more
-
security.nl
Check Point waarschuwt voor actief misbruik van kritiek SmartConsole-lek
Cybersecuritybedrijf Check Point waarschuwt voor actief misbruik van een kritieke kwetsbaarheid waardoor aanvallers via SmartConsole als admin op een beveiligingsoplossing van het bedrijf kunnen inlog ... Read more
-
The Hacker News
Check Point Patches Exploited SmartConsole Flaw Allowing Full Admin Access
Check Point has released security updates to address multiple vulnerabilities impacting Security Management and Multi-Domain Management (MDSM) products, including a critical flaw that has come under a ... Read more
The following table lists the changes that have been made to the
CVE-2026-16232 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Modified Analysis by [email protected]
Aug. 10, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Added Reference Type CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232 Types: US Government Resource -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 10, 2026
Action Type Old Value New Value Added Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232 Removed Reference https://vincent.vulcoord.net/score/?state=KEV&state=Reassess&excludecna=linux&cve=CVE-2026-16232&analyze=1 -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 10, 2026
Action Type Old Value New Value Changed SSVC {'id': 'CVE-2026-16232', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'active'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-07-22T00:00:00+00:00'} {'id': 'CVE-2026-16232', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'active'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-07-23T03:55:51.690584Z'} Removed CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Added Reference https://vincent.vulcoord.net/score/?state=KEV&state=Reassess&excludecna=linux&cve=CVE-2026-16232&analyze=1 Removed Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232 Removed Reference Type https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232 Types: US Government Resource -
Modified Analysis by [email protected]
Aug. 03, 2026
Action Type Old Value New Value -
CVE Modified by [email protected]
Aug. 02, 2026
Action Type Old Value New Value Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X -
Initial Analysis by [email protected]
Jul. 23, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:checkpoint:multi-domain_security_management:*:*:*:*:*:*:*:* versions from (including) r77.30 up to (excluding) r81.20 *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:-:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r82:-:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r82.10:-:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_10:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_101:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_103:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_105:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_111:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_113:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_115:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_118:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_119:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_120:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_122:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_126:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_127:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_14:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_141:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_24:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_26:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_38:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_41:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_43:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_45:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_53:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_54:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_65:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_70:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_76:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_79:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_8:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_84:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_89:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_90:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_92:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_96:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_98:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_99:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_10:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_103:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_12:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_14:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_18:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_19:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_25:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_33:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_34:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_36:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_39:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_41:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_43:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_44:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_60:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_73:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_91:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_146:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_107:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r82.10:take_19:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r82.10:take_24:*:*:*:*:*:* *cpe:2.3:a:checkpoint:multi-domain_security_management:r82.10:take_6:*:*:*:*:*:* Added CPE Configuration OR *cpe:2.3:a:checkpoint:quantum_security_management:*:*:*:*:*:*:*:* versions from (including) r77.30 up to (excluding) r81.20 *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:-:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_10:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_101:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_103:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_105:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_111:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_113:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_115:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_118:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_119:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_120:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_122:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_126:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_127:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_14:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_141:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_146:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_24:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_26:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_38:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_41:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_43:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_45:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_53:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_54:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_65:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_70:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_76:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_79:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_8:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_84:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_89:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_90:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_92:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_96:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_98:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_99:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r82:-:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r82:take_10:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r82:take_103:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r82:take_107:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r82:take_12:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r82:take_14:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r82:take_18:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r82:take_19:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r82:take_25:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r82:take_33:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r82:take_34:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r82:take_36:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r82:take_39:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r82:take_41:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r82:take_43:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r82:take_44:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r82:take_60:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r82:take_73:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r82:take_91:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r82.10:-:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r82.10:take_19:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r82.10:take_24:*:*:*:*:*:* *cpe:2.3:a:checkpoint:quantum_security_management:r82.10:take_6:*:*:*:*:*:* Added Reference Type Check Point Software Technologies Ltd.: https://support.checkpoint.com/results/sk/sk185169 Types: Mitigation, Patch, Vendor Advisory Added Reference Type CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232 Types: US Government Resource -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 23, 2026
Action Type Old Value New Value Changed SSVC {'id': 'CVE-2026-16232', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'active'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-07-22T20:45:04.891100Z'} {'id': 'CVE-2026-16232', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'active'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-07-22T00:00:00+00:00'} -
CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725
Jul. 22, 2026
Action Type Old Value New Value Added Date Added 2026-07-22 Added Due Date 2026-07-22 Added Required Action 2026-07-22 Added Vulnerability Name 2026-07-22 -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 22, 2026
Action Type Old Value New Value Changed SSVC {'id': 'CVE-2026-16232', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-07-22T19:29:23.246874Z'} {'id': 'CVE-2026-16232', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'active'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-07-22T20:45:04.891100Z'} -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 22, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Added Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232 Added SSVC {'id': 'CVE-2026-16232', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-07-22T19:29:23.246874Z'} -
New CVE Received by [email protected]
Jul. 22, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'checkpoint', 'product': 'Quantum Security Management', 'versions': [{'status': 'affected', 'version': 'R82.10 with Jumbo Hotfix Take 36 or below'}, {'status': 'affected', 'version': 'R82 with Jumbo Hotfix Take 118 or below'}, {'status': 'affected', 'version': 'R81.20 with Jumbo Hotfix Take 158 or below'}, {'status': 'affected', 'version': 'R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30'}]}, {'vendor': 'checkpoint', 'product': 'Multi-Domain Security Management', 'versions': [{'status': 'affected', 'version': 'R82.10 with Jumbo Hotfix Take 36 or below'}, {'status': 'affected', 'version': 'R82 with Jumbo Hotfix Take 118 or below'}, {'status': 'affected', 'version': 'R81.20 with Jumbo Hotfix Take 158 or below'}, {'status': 'affected', 'version': 'R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30'}]}] Added Description An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers. Added CWE CWE-287 Added Reference https://support.checkpoint.com/results/sk/sk185169